Fly-By-Wire Flight Control Computer
A Tier-1/2 aerospace supplier (~600 staff, ~250 engineers, 20 on this program) is building the primary flight control computer for a regional aircraft. Loss of the pitch/roll control law is classified Catastrophic in the ARP4761 FHA, forcing IDAL-A and the full 71-objective DO-178C set — many satisfied 'with independence.' The architecture uses command/monitor (COM/MON) lanes across dual/triplex channels; the open decision is a TI TMS570 / Cortex-R5F lockstep effector design versus an NXP QorIQ T2080 multicore under CAST-32A. Control laws run at ~64 Hz (a 15.6 ms minor frame) on an ARINC 653 partitioned RTOS.
Illustrative scenario — representative figures, not a customer result.
of low-level verification claimed as DO-333 formal credit
processor decision, settled formally
objective-compliance matrix auto-generated
- Systems safety (ARP4754A / ARP4761 — FHA / PSSA / SSA, FDAL/IDAL allocation)
- Control-law / model-based-design team (SCADE or Simulink)
- Independent software verification (satisfies the with-independence objectives)
- WCET & timing engineer (AbsInt aiT-style analysis)
- Configuration management + Software Quality Assurance
- FAA DER / EASA SME (runs the SOI-1…SOI-4 audits)
- IBM DOORS — 1,400+ shall-statements, bidirectional traceability
- Ansys SCADE Suite / Simulink — Control-law model-based design
- VectorCAST / LDRA — Requirements-based test, MC/DC coverage
- AbsInt aiT — Sound worst-case execution-time bounds
- Green Hills INTEGRITY-178 tuMP — ARINC 653 DAL-A multicore RTOS
DAL-A verification — requirements-based testing plus MC/DC structural coverage with independence, data/control-coupling analysis and WCET — is 50–70% of program cost. The processor choice ripples through scheduling, ARINC 653 partitioning, CAST-32A multicore-interference mitigation and the certification evidence, yet no tool analyses hardware and software jointly. The decision has stalled the program for months awaiting formal schedulability analysis.
Verification, not code, is the program
71 objectives, ~30 of them with independence, with MC/DC measured on the optimized target build. Coding is a small slice while the test campaign and its evidence dominate the budget.
The processor decision has no joint model
Cortex-R5F lockstep versus a T2080 multicore changes scheduling, the CAST-32A interference argument and the DAL-A evidence — analysed today by committee and prototype, not by proof.
Timing is proven late
WCET and redundant-channel-takeover latency are validated near the end, on target. A missed 15.6 ms frame budget forces rework three phases deep, after the architecture is frozen.
Formal credit is left on the table
DO-333 allows model-checking and proof to earn certification credit against test objectives — but stitching that credit into the DO-178C Annex A objective tables by hand is rarely attempted.
A months-long architecture review, an MC/DC-heavy test campaign consuming ~55% of a €3.2M/yr program, and DO-178C evidence assembled by hand — with the available formal credit unclaimed.
One coherent flow, applied to this system.
-
01Requirements Ingest DOORS shall-statements and structure HLR → LLR with traceability.
Dextra ingests 1,400+ shall-statements from IBM DOORS, structures high- and low-level requirements with bidirectional traceability, and the threat library adds command-authentication and sensor-integrity requirements. These become the SOI-1 planning inputs.
Output Structured, traceable requirement set + PSAC/SOI-1 inputs. -
02Behaviour Model the control loop and COM/MON redundancy as a timed automaton.
SENSOR_READ → COMPUTE → ACTUATE, plus the COM/MON cross-check → fail-passive disconnect → redundant-channel takeover, are captured as a timed automaton with derived TCTL timing and safety properties over the 15.6 ms minor frame.
Output Behavioural contract + TCTL properties (timing, fail-passive, takeover). -
03Formal verification Discharge low-level-requirement verification as DO-333 formal credit.
Model checking discharges a share of low-level-requirement verification as DO-333 credit (sound methods against the FM.A-3…A-6 objectives), and abstract-interpretation / SPARK proofs establish absence of run-time errors — replacing portions of the unit-test and robustness-test campaign. (Honest note: target-based testing and a source→object property-preservation argument remain required, and the generator/checker carry DO-330 qualification.)
Output Proof logs mapped to the DO-178C objective tables + absence-of-runtime-error evidence. -
04Design-space exploration Settle the joint HW/SW trade with WCET and cert-cost in the loop.
The Pareto trade runs Cortex-R5F lockstep versus QorIQ T2080 multicore × task decomposition × RMA vs partitioned schedule. Each point is WCET-checked (a sound aiT-style bound against the 15.6 ms frame under the ~69% rate-monotonic utilization margin) and scored on certification complexity — lockstep simplifies DAL-A evidence, while multicore adds the CAST-32A interference-channel work.
Output Pareto of processor/schedule configurations vs certification cost. -
05Platform selection Fix the schedulable, partitioned platform.
The selection lands, for example, Cortex-R5F lockstep effector lanes with the control-law partition on INTEGRITY-178 tuMP (ARINC 653), a DAL-B monitor partition and a DAL-C maintenance partition isolated in time and space on-core, with air-data over a dual-redundant AFDX network policed by a 2 ms BAG.
Output Fully specified, schedulable, partitioned platform. -
06Certification artifacts Emit verified code to a qualified backend and auto-build the evidence package.
Verified C/Ada is emitted to a qualified backend (SCADE KCG or SPARK Ada), and the Software Accomplishment Summary plus the Table A-1…A-10 objective-compliance matrix are generated. At SOI-3 the DER pulls any shall-statement and traces it forward through TCTL property → proof → generated code → coverage as one thread.
Output DO-178C evidence package + one-click requirement-to-coverage thread.
AG(sensor_input → AF≤10ms actuator_output)
Every control frame reads the sensors, computes the law and drives the actuator within the hard 10 ms deadline.
AG(lane_mismatch_persistent → AF≤3·frame fail_passive_disconnect)
A persistent command/monitor disagreement passivates the channel within a bounded number of frames.
AG(channel_fail → AF≤100ms (redundant_takeover ∧ transient_free))
Loss of a channel is taken over by a redundant channel within sub-100 ms and without a transient to the airframe.
An interactive Pareto frontier for this system — every point a valid, formally checked configuration. Hover any point to inspect the full hardware-software specification.
Modeled, conservative and sourced — see the full ROI methodology.
The verification bucket that eats the program shrinks: model checking claims DO-333 credit against the test campaign, the stalled processor decision is settled by a joint HW/SW trade in days, and the DO-178C evidence assembles itself as a traceable thread the DER can pull at SOI-3. Modeled ROI: ~462%, payback ~2 months.
See how the pipeline works.
From requirements to certified artifacts, in six stages.